Procmon saved me

Lets start with little rant.
For the last month I’ve been trying to setup proper PKI infrastracture in Windows dominated domain.
The idea was:

Root CA
   |
   v
Sub CA
   |
   v
CEP/CES
   |
   v
Clients

So basically no RPC calls to DCs or CA from clients - more isolated, more secure.
Except I’ve been getting tons of timeouts on Clients trying to get Enrollment Policy from CEP…

Weirdly sometimes it did work, sometimes it didn’t. I was baffled, built 2 labs trying to recreate issue, no issues there.
Trying to diagnose it through windows Event Viewer was impossible, nothing was telling me why. Logs from IIS didn’t help either, as when I was getting timeouts - there was nothing in them.

Wireshark showed something interesting - ~30-35 sec break after Client-Server Hello and rest of communication - if it were to happen. It was on Client side!
So knowing that I had to search there, on clients that had issues - since, as I noticed, not all had this issue.
To find what caused timeouts I finally narrowed it down to CRL/OCSP checks with command to diagnose:

Measure-Command { certutil -urlfetch -verify server.cer }

It returned very weird, stable 15 sec.

Then comes my saviour. Procmon.
With filters for certutil.exe process name I found gap in time - TCP connection to ctldl.windowsupdate.com timeout!

Turns out, Windows tries to download CTL lists from Windows Update (even without urlfetch parametr) and goes to timeout if it has no internet access.
Finally found obscure Learn Microsoft article about configuring it in isolated envoirments and hosted CTLs on my CEP/CES server, pointing all Clients there.
Problem solved, but what the F**** Microsoft?! Couldn’t you bake it into WSUS and not waste my time?

Well, at least I learned something.